Synopsis

firefox security update

Type/Severity

Security Advisory: Critical

Topic

An updated firefox package that fixes several security bugs is now available.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

Description

Mozilla Firefox is an open source Web browser.

Igor Bukanov discovered a bug in the way Firefox's Javascript interpreter
derefernces objects. If a user visits a malicious web page, Firefox could
crash or execute arbitrary code as the user running Firefox. The Common
Vulnerabilities and Exposures project assigned the name CVE-2006-0292 to
this issue.

moz_bug_r_a4 discovered a bug in Firefox's XULDocument.persist() function.
A malicious web page could inject arbitrary RDF data into a user's
localstore.rdf file, which can cause Firefox to execute arbitrary
javascript when a user runs Firefox. (CVE-2006-0296)

A denial of service bug was found in the way Firefox saves history
information. If a user visits a web page with a very long title, it is
possible Firefox will crash or take a very long time the next time it is
run. (CVE-2005-4134)

This update also fixes a bug when using XSLT to transform documents.
Passing DOM Nodes as parameters to functions expecting an xsl:param could
cause Firefox to throw an exception.

Users of Firefox are advised to upgrade to this updated package, which
contains backported patches to correct these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 179171 - CVE-2005-4134 Very long topic history.dat DoS
• BZ - 179173 - CVE-2006-0292 javascript unrooted access
• BZ - 179175 - CVE-2006-0296 XULDocument.persist() RDF data injection

CVEs

• CVE-2006-0292
• CVE-2005-4134
• CVE-2006-0296

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
firefox-1.0.7-1.4.3.src.rpm	SHA-256: 29c432d41dacb019e5e7f188d885e382f37ec3aca553810af55a05d6a140fe70
x86_64
firefox-1.0.7-1.4.3.x86_64.rpm	SHA-256: 35f12e19c44497244fcdfef99bcb900ef27c24e177acc9315b13eec0578922d2
firefox-1.0.7-1.4.3.x86_64.rpm	SHA-256: 35f12e19c44497244fcdfef99bcb900ef27c24e177acc9315b13eec0578922d2
ia64
firefox-1.0.7-1.4.3.ia64.rpm	SHA-256: b3ec849ecbee43401d8761d8fee8db576c83d78cbf3d19db49bf3ffe9f28e269
firefox-1.0.7-1.4.3.ia64.rpm	SHA-256: b3ec849ecbee43401d8761d8fee8db576c83d78cbf3d19db49bf3ffe9f28e269
i386
firefox-1.0.7-1.4.3.i386.rpm	SHA-256: 743f7e3083484ce79f75b8318f5804fa7f37c3d98b4f01c1eb26b76689296da3
firefox-1.0.7-1.4.3.i386.rpm	SHA-256: 743f7e3083484ce79f75b8318f5804fa7f37c3d98b4f01c1eb26b76689296da3

Red Hat Enterprise Linux Workstation 4

SRPM
firefox-1.0.7-1.4.3.src.rpm	SHA-256: 29c432d41dacb019e5e7f188d885e382f37ec3aca553810af55a05d6a140fe70
x86_64
firefox-1.0.7-1.4.3.x86_64.rpm	SHA-256: 35f12e19c44497244fcdfef99bcb900ef27c24e177acc9315b13eec0578922d2
ia64
firefox-1.0.7-1.4.3.ia64.rpm	SHA-256: b3ec849ecbee43401d8761d8fee8db576c83d78cbf3d19db49bf3ffe9f28e269
i386
firefox-1.0.7-1.4.3.i386.rpm	SHA-256: 743f7e3083484ce79f75b8318f5804fa7f37c3d98b4f01c1eb26b76689296da3

Red Hat Enterprise Linux Desktop 4

SRPM
firefox-1.0.7-1.4.3.src.rpm	SHA-256: 29c432d41dacb019e5e7f188d885e382f37ec3aca553810af55a05d6a140fe70
x86_64
firefox-1.0.7-1.4.3.x86_64.rpm	SHA-256: 35f12e19c44497244fcdfef99bcb900ef27c24e177acc9315b13eec0578922d2
i386
firefox-1.0.7-1.4.3.i386.rpm	SHA-256: 743f7e3083484ce79f75b8318f5804fa7f37c3d98b4f01c1eb26b76689296da3

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
firefox-1.0.7-1.4.3.src.rpm	SHA-256: 29c432d41dacb019e5e7f188d885e382f37ec3aca553810af55a05d6a140fe70
s390x
firefox-1.0.7-1.4.3.s390x.rpm	SHA-256: f9ab01a50334526fe568092f39b488f7e28f8246b0a85fce8820a00c96185d8c
s390
firefox-1.0.7-1.4.3.s390.rpm	SHA-256: f1ad5d9e62876b6e7ff5b7dbba2716422b4a3e006f55d4463551e3b6ef49624f

Red Hat Enterprise Linux for Power, big endian 4

SRPM
firefox-1.0.7-1.4.3.src.rpm	SHA-256: 29c432d41dacb019e5e7f188d885e382f37ec3aca553810af55a05d6a140fe70
ppc
firefox-1.0.7-1.4.3.ppc.rpm	SHA-256: ef08d3c81d525f36ffdbefafd05981bfcccf0630871cb0228418fc97ec35d014